MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2010dfaf7b4736b0c60265875c8a1ac0595f9929a325d25093424e9c698bcb58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VirLock


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2010dfaf7b4736b0c60265875c8a1ac0595f9929a325d25093424e9c698bcb58
SHA3-384 hash: a485ce4261a4684e0f6ff7b1af82f2ca93fe245d65a7466675cb139f10d4bdce2c8a0efcfc833802e2a277b44ded8633
SHA1 hash: 4e4a734ba7e12f0cb321bb6666534ec7d5ceeecb
MD5 hash: b2793bcdc304a97b655369ee611da4ce
humanhash: wyoming-colorado-potato-king
File name:b2793bcd_by_Libranalysis
Download: download sample
Signature VirLock
Create hunting rule
File size:770'560 bytes
First seen:2021-05-05 09:07:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7aabfe35802e11927d115a55c4cf289e (1 x VirLock)
ssdeep 12288:roq3cmyxDBYEQTF/cR3La6HXgyTRHpZEUjqTm:Hfyxlt+F+BQyTRjwTm
Threatray 149 similar samples on MalwareBazaar
TLSH DCF4BE296E498924D38E72353E99F5E4F1F5D6E6D0BB7B0A3060DE46AB572DCC43CA00
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150221/
Detection(s):
Win.Virus.Virlock-6332874-0
Create hunting rule

Win.Virus.Virlock-6804475-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file
Creating a process from a recently created file
Creating a service
Launching a service
DNS request
Creating a file in the Windows subdirectories
Sending an HTTP GET request
Creating a file in the %temp% directory
Searching for the window
Running batch commands
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/711732
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to check if Internet connection is working
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Creates an undocumented autostart registry key
Delayed program exit found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404790 Sample: b2793bcd_by_Libranalysis Startdate: 05/05/2021 Architecture: WINDOWS Score: 96 47 Antivirus / Scanner detection for submitted sample 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Machine Learning detection for sample 2->51 7 b2793bcd_by_Libranalysis.exe 3 15 2->7         started        11 KqcUYwYY.exe 4 2->11         started        13 svchost.exe 1 2->13         started        15 3 other processes 2->15 process3 file4 37 C:\Users\user\qgQEUQQA\wOcgYUEQ.exe, PE32 7->37 dropped 39 C:\ProgramData\dcAkcAww\HQUMEEYk.exe, PE32 7->39 dropped 41 C:\ProgramData\XGsgEYMo\KqcUYwYY.exe, PE32 7->41 dropped 43 C:\Users\user\AppData\Local\Temp\cver.exe, PE32 7->43 dropped 63 Creates an undocumented autostart registry key 7->63 65 Uses cmd line tools excessively to alter registry or file data 7->65 67 Tries to detect virtualization through RDTSC time measurements 7->67 17 HQUMEEYk.exe 2 7->17         started        21 wOcgYUEQ.exe 12 7->21         started        23 cmd.exe 1 7->23         started        25 3 other processes 7->25 69 Antivirus detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Delayed program exit found 11->73 signatures5 process6 dnsIp7 45 192.168.2.1 unknown unknown 17->45 53 Antivirus detection for dropped file 17->53 55 Contains functionality to check if Internet connection is working 17->55 57 Machine Learning detection for dropped file 17->57 61 2 other signatures 17->61 59 Tries to detect virtualization through RDTSC time measurements 21->59 27 conhost.exe 23->27         started        29 cver.exe 23->29         started        31 conhost.exe 25->31         started        33 conhost.exe 25->33         started        35 conhost.exe 25->35         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2010dfaf7b4736b0c60265875c8a1ac0595f9929a325d25093424e9c698bcb58/
Threat name:
Win32.Ransomware.VirLock
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 00:58:52 UTC
AV detection:
47 of 48 (97.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef
VirLock
2e949fd381c6fe57dd97fa241bbc8c530cbc0e85891074056ff4085f0dbd9484
VirLock
41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098
VirLock
671fb988c777ad27531f39dd4fb5f4c4483fb7b07e8e493cd72ee8a6572db576
VirLock
89164a030c95d2445557ae7a793a7ab7d849b628fbafb0f483100c580a043a93
VirLock
8926a917f30b552fa4aa51861c526754c8033c286526a2fb95ed7663fbd690ab
VirLock
8ee51302e53d652b2c2e5683e9810240bdc903b19b2e3b1aae712d123405e4d0
VirLock
baeb7f87041595c27abc2df4fd3cbdea1e21144bcd7d9e2bbc3b6251e4af0370
VirLock
c09e2aa12f24fe3f28ea4ece099700c8015daf728b00dc45d94412c81bd5fe03
VirLock
eec416c651bf36aef09c456d4ba9ae03f502bb31cfa2237bf8ea30dbbea053b5
VirLock
+ 139 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/210505-r8lyge8e2e/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies extensions of user files
Modifies WinLogon for persistence
Modifies visibility of file extensions in Explorer
UAC bypass
Unpacked files
SH256 hash:
d22278c8b2f72b22fb7367af6dc98472a856334645e6bb3452a244e71d7000ba
MD5 hash:
b99fd2a9ed7d606e27d23c3e7c7b91c7
SHA1 hash:
766e942e3942b42911af167cea93f517ad51aa20
Link:
https://www.unpac.me/results/8a3ed192-c9b5-4be8-abb2-de7fb1ac3ced/
SH256 hash:
7f857c1f8b7805737ea9ba6148f2e1817c808ddf656d51066985d568756319e2
MD5 hash:
a004feb6c1b29eee793ba6250d01f529
SHA1 hash:
45ff05c3a7bb7f79b76713ad72049ad37ac4d54c
Link:
https://www.unpac.me/results/8a3ed192-c9b5-4be8-abb2-de7fb1ac3ced/
SH256 hash:
0dd32695f42c485a030cb0e31e7f701cadead4f95a971c78aa4f12d5943290c6
MD5 hash:
02786b82073906f4dbbe815e2b308e48
SHA1 hash:
fd1804913d5665f78a3bb25ea9d32b13d466317d
Link:
https://www.unpac.me/results/8a3ed192-c9b5-4be8-abb2-de7fb1ac3ced/
SH256 hash:
2010dfaf7b4736b0c60265875c8a1ac0595f9929a325d25093424e9c698bcb58
MD5 hash:
b2793bcdc304a97b655369ee611da4ce
SHA1 hash:
4e4a734ba7e12f0cb321bb6666534ec7d5ceeecb
Link:
https://www.unpac.me/results/8a3ed192-c9b5-4be8-abb2-de7fb1ac3ced/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150221/

Comments